Compania Google a anun\u021bat formarea primelor versiuni stabile ale componentelor care formeaz\u0103 proiectul Sigstore, declarat adecvat pentru implement\u0103ri de lucru. Sigstore dezvolt\u0103 instrumente \u0219i servicii pentru verificarea software-ului prin semn\u0103turi digitale \u0219i men\u021binerea unui jurnal public care confirm\u0103 autenticitatea modific\u0103rilor (transparency log). Proiectul este dezvoltat sub egida organiza\u021biei non-profit Linux Foundation, de c\u0103tre companiile Google, Red Hat, Cisco, vmWare, GitHub \u0219i HP Enterprise, \u00een colaborare cu organiza\u021bia OpenSSF (Open Source Security Foundation) \u0219i Universitatea Purdue. <\/p>\n
Sigstore poate fi considerat un echivalent al Let’s Encrypt pentru cod, oferind certificate pentru semnarea codului digital \u0219i un set de instrumente pentru automatizarea verific\u0103rii. Prin intermediul Sigstore, dezvoltatorii vor putea crea semn\u0103turi digitale pentru artefactele legate de aplica\u021bie, cum ar fi fi\u0219ierele de lansare, imaginile containerelor, manife\u0219tele \u0219i executabilele. Materialul utilizat pentru semnare este reflectat \u00eentr-un jurnal public protejat \u00eempotriva modific\u0103rilor, care poate fi folosit pentru verificare \u0219i audit. <\/p>\n
\u00cen loc de chei permanente, Sigstore utilizeaz\u0103 chei efemere cu durat\u0103 scurt\u0103, generate pe baza acreditivelor confirmate de furnizorii OpenID Connect (\u00een momentul gener\u0103rii cheilor necesare pentru crearea semn\u0103turii digitale, dezvoltatorul se identific\u0103 prin furnizorul OpenID legat de email). Autenticitatea cheilor este verificat\u0103 printr-un jurnal public centralizat, care permite asigurarea c\u0103 autorul semn\u0103turii este cel care pretinde a fi \u0219i c\u0103 semn\u0103tura a fost creat\u0103 de acela\u0219i participant responsabil pentru versiunile anterioare. <\/p>\n
Preg\u0103tirea Sigstore pentru implementare se datoreaz\u0103 lans\u0103rii a dou\u0103 componente cheie — Rekor 1.0 \u0219i Fulcio 1.0, interfe\u021bele de programare ale c\u0103ror au fost declarate stabile \u0219i vor p\u0103stra \u00een continuare compatibilitatea. Componentele serviciului sunt scrise \u00een limbajul Go \u0219i sunt distribuite sub licen\u021ba Apache 2.0. <\/p>\n
Componenta Rekor con\u021bine o implementare a jurnalului pentru stocarea metadatelor semnate digital, care reflect\u0103 informa\u021biile despre proiecte. Pentru a asigura integritatea \u0219i protec\u021bia \u00eempotriva denatur\u0103rii datelor retroactive, se aplic\u0103 o structur\u0103 \u00een arbore «arborele Merkle» (Merkle Tree), \u00een care fiecare ramur\u0103 verific\u0103 toate ramurile \u0219i nodurile subiacente prin intermediul hash-ului comun (\u00een arbore). Av\u00e2nd un hash final, utilizatorul se poate asigura de corectitudinea \u00eentregii istorii a opera\u021biunilor, precum \u0219i de corectitudinea st\u0103rilor anterioare ale BD-ului (hash-ul de verificare a r\u0103d\u0103cinii noului st\u0103rii a bazei de date este calculat av\u00e2nd \u00een vedere starea anterioar\u0103). Pentru verificarea \u0219i ad\u0103ugarea de \u00eenregistr\u0103ri noi este disponibil un API RESTful, precum \u0219i o interfa\u021b\u0103 de linie de comand\u0103. <\/p>\n
Componenta Fulcio (SigStore WebPKI) include un sistem pentru crearea autorit\u0103\u021bilor de certificare (CA r\u0103d\u0103cin\u0103) care emit certificate cu o durat\u0103 scurt\u0103 de via\u021b\u0103 bazate pe email, autentificate prin OpenID Connect. Durata de via\u021b\u0103 a certificatului este de 20 de minute, timp \u00een care dezvoltatorul trebuie s\u0103 reu\u0219easc\u0103 s\u0103 formeze o semn\u0103tur\u0103 digital\u0103 (dac\u0103 ulterior certificatul ajunge \u00een m\u00e2inile unui atacator, acesta va fi deja expirat). De asemenea, proiectul dezvolt\u0103 un set de instrumente Cosign (Container Signing), destinat gener\u0103rii semn\u0103turilor pentru containere, verific\u0103rii semn\u0103turilor \u0219i plas\u0103rii containerelor semnate \u00een depozitele compatibile cu OCI (Open Container Initiative). <\/p>\n
Implementarea Sigstore permite cre\u0219terea securit\u0103\u021bii canalelor de distribu\u021bie a software-ului \u0219i protec\u021bia \u00eempotriva atacurilor viz\u00e2nd falsificarea bibliotecilor \u0219i dependen\u021belor (supply chain). Una dintre problemele cheie de securitate \u00een software-ul open source este dificultatea de a verifica sursa de ob\u021binere a programului \u0219i de a verifica procesul de construire. De exemplu, pentru a verifica integritatea unei versiuni, majoritatea proiectelor utilizeaz\u0103 hash-uri, \u00eens\u0103 adesea informa\u021biile necesare pentru a verifica autenticitatea sunt stocate \u00een sisteme nesecurizate \u0219i \u00een depozite comune de cod, rezult\u00e2nd din compromiterea c\u0103rora atacatorii pot altera fi\u0219ierele necesare pentru verificare \u0219i, f\u0103r\u0103 a st\u00e2rni suspiciuni, pot introduce modific\u0103ri mali\u021bioase. <\/p>\n
Utilizarea semn\u0103turilor digitale pentru verificarea lans\u0103rilor nu a c\u00e2\u0219tigat \u00eenc\u0103 o popularitate generalizat\u0103 din cauza dificult\u0103\u021bilor \u00een gestionarea cheilor, distribu\u021bia cheilor publice \u0219i revocarea cheilor compromise. Pentru ca verificarea s\u0103 aib\u0103 sens, este necesar s\u0103 se organizeze un proces fiabil \u0219i sigur de distribu\u021bie a cheilor publice \u0219i a sumelor de control. Chiar \u0219i \u00een prezen\u021ba unei semn\u0103turi digitale, mul\u021bi utilizatori ignor\u0103 verificarea, deoarece trebuie s\u0103 investeasc\u0103 timp \u00een \u00eenv\u0103\u021barea procesului de verificare \u0219i s\u0103 \u00een\u021beleag\u0103 care cheie merit\u0103 \u00eencrederea. Proiectul Sigstore \u00eencearc\u0103 s\u0103 simplifice \u0219i s\u0103 automatizeze aceste procese, oferind o solu\u021bie gata de utilizare \u0219i verificat\u0103. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439. Sigstore \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0434\u043b\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0438 \u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u043b\u043e\u0433\u0430, \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 (transparency log). \u041f\u0440\u043e\u0435\u043a\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u044d\u0433\u0438\u0434\u043e\u0439 \u043d\u0435\u043a\u043e\u043c\u043c\u0435\u0440\u0447\u0435\u0441\u043a\u043e\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Foundation \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Google, Red Hat, Cisco, vmWare, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105382","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anun\u021barea disponibilit\u0103\u021bii sistemului de verificare criptografic\u0103 a codului Sigstore | ProHoster","description":"Compania Google a anun\u021bat formarea primelor versiuni stabile ale componentelor care constituie proiectul Sigstore, care a fost declarat adecvat pentru crearea implement\u0103rilor func\u021bionale.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043e \u043e \u0433\u043e\u0442\u043e\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 Sigstore | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u044b\u0445 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u0440\u043e\u0435\u043a\u0442 Sigstore, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d \u043f\u0440\u0438\u0433\u043e\u0434\u043d\u044b\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/obyavleno-o-gotovnosti-sistemy-kriptograficheskoj-verifikaczii-koda-sigstore","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-25T19:36:48+00:00","article:modified_time":"2022-10-25T19:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105382"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105382\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"